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Special switch port set up for port aliasing. 
This port is tied directly to the switch backbone 



Figure 1 
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Adding a repeater allows a 
• LAN analyzer to capture 
frames from a switch port. 



LAN Analyzer and Sniffer 



Figure 2 (PRIOR ART) 
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Monitor Device 335 



Cable connecting Switch data 
interface to Monitor 



Cable connecting Switch 
mirror interface to Monitor 31 5 



Host A 
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Host B 
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Cable connecting 
Host B to Switch 
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Switch 310 



Figure 3 
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1 . Destination Address 
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2. Source Address 



3. Data 
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Figure 4 
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1. Packet from 
Host A to Host B 

2. Packet from 
Host A to Host B 



Network 
Switch 



515 



3. Packet from Host A to Host B 



4. Request dotldTpFdbPort. <address> 



5. Response dotldTpFdbPort. <address> 



6. Request dot1 dBasePortlflndex. <port> 



7. Response dot1 dBasePortlflndex. <port> 
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Figure 5 
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Flow Chart - Receiving a Packet from the Mirror Port 



Step 610 

wait for packet 



Step 


620 


packet.time = now; 




entry = lookup(addrTbl, packet.src); 



entry == 0 



Step 630 

entry = add Entry (addrTbl, packet.src); 
entry.lastAttempt =0; 



Step 640 

entry.lastAttempt = now; 
send_port_req(packet.src) 




((now - entry.lastUpdate) < maxAgel) 



((now - entry.lastUpdate) 
>= maxAgel) 



Step 


660 


packet.srcinterface 


= entry.interface; 




Step 670 

Process(packet) 



Step 650 

fifo_put(packet) 



(now -entry.lastAttempt) 
>= mininterval 



(now - entry.lastAttempt) 
< mininterval 



Figure 6 
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Flow Chart - Receiving an SNMP Response 





Step 710 

wait for SNMP Response 




1 ► 







resp.type == 


dotldTpFdbPort / 






Step 720 


entry = lookup(addrTbl,resp.address); 


entry.port = resp.port; 




f 



Step 730 

pentry = lookup(prtTbl ) resp.port); 



resp.type == dotldBasePortlflndex 



Step 


770 


pentry = lookup(prtTbl, resp.port); 


pentry.lastUpdate 


= now; 


pentry.interface = 


resp.interface; 




pentry != 0 



pentry == 0, r 



Step 


740 


pentry = addEntry(prtTbl, resp.port); 


< 




Step 


750 


pentry.lastAttempt = now; « 


send_interface_req(resp.port) 



Step 760 

updateFlag = ((now - pentry.lastUpdate) >= maxAge2) 
&& ((now - pentry.lastAttempt) >= minAttempt) 



updateFlag == true 




updateFlag == false 



Figure 7 
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Flow Chart - Removing Packets from FIFO 



Step 810 

wait(fifo_pollingJnterval) 




fifo_empty() 



fifo_empty() 




((now - fifo_oldest().time) 
<maxDelay) 



((now - fifo_oldest().time) 
>=maxDelay) 



Step 820 

packet = fifo_remove(); 

entry = lookup(addrTbl, packet.src) 



Step 830 

pentry = lookup(prtTbl, entry.port); 



((now -entry.lastUpdate) 
>= maxAgel) 




pentry == 0 



pentry != 0 




Step 


840 


interface = pentry.interface; 


< 


^^interface 




interface != 0 


Step 


850 


entry.interface 


= interface; 


entry.lastUpdate = novy; 



((now -entry.lastUpdate) 
< maxAgel) 



Step 860 

packet.srcinterface = entry.interface; 



Step 870 

process(packet); 



Figure 8 



